Nope. Smurf has nothing to do with ntop, since except in reply to web requests, ntop doesn't send anything. So worry about smurf and a compromised box, not ntop...
In fact it's absolutely necessary for ntop to place interfaces in promiscuous mode (just like snort, etc.) - otherwise ntop doesn't see all the traffic. Read docs/FAQ. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Niels Sent: Monday, April 04, 2005 1:04 PM To: [email protected] Subject: [Ntop] Promisc mode dangerous? Hi, I'm running Ntop on a Linux router. Eth0 is connected to an adsl/nat/router thingy, eth1 is connected to the inside LAN. Is it dangerous (ie. unsafe) to run those interfaces in promisc mode? I'm seeing a lot of Smurf warnings in the log, all seemingly directed to one machine on the LAN, and most seemingly coming from the Ntop server. Should I worry? Thanks, Niels _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
